MOD-HEAVY
CyberLabs Training Division
SIMULATED DEFEND ONLY

Operations Floor · Hub

Defensive drills for teams who can’t afford to guess.

MOD-HEAVY is CyberLabs’ training floor: investigate alerts, contain risk, and document what you did — without ever breaking into a system. All incidents are fiction.

  • Detect triage signals
  • Decide severity & action
  • Contain safely
  • Document after-action
Start Mission Zero Start Mission One Start Mission Two Start Mission Three Start Mission Four

Mission Zero

M0 · Static on the Line

Orientation + first alert triage for simulated client Northglass Logistics.

Enter briefing

Mission One

M1 · Phish in the Wire

A vendor invoice hits the Northglass AP list. Inspect it, scope who bit, contain, and file the report. ~10–20 min.

Enter briefing

Mission Two

M2 · Ghost Process

Northglass’ AI coding agent did something nobody asked for. Find the disguised process, scope the leaked secrets, contain, and report. ~15–25 min.

Enter briefing

Mission Three

M3 · Exfil Whisper

A forgotten warehouse label printer is whispering data out over DNS, one tiny lookup a minute. Find the channel, scope what left, cut it off, and report. ~20–30 min.

Enter briefing

Mission Four

M4 · Lantern Court

A trusted animated-GIF email signature is hiding stolen data and beaconing home from a look-alike CDN. Decode the covert channel, secure the abused mailbox, scope what left, and report. ~25–35 min.

Enter briefing

Later modules

M5 · Locked

Last Light — getting ahead of the Lantern Court operator. Shipping as the floor expands.

Rules of engagement

Blue team only. No exploitation, no pwn, no attack playbooks. Curiosity stops at containment.

About

What MOD-HEAVY is

A productized defensive lab experience under CyberLabs. You play a shift analyst: something odd hits a simulated network, and your job is to understand it and stop the bleeding — not to break in.

Related aesthetic language to other CyberLabs lore projects, but this floor is professional ops-console — not arcade CRT. Evidence is fabricated (fake company, documentation-range IPs, hashes labeled SIMULATION).

Start Mission Zero Start Mission One Start Mission Two Start Mission Three Start Mission Four

Briefing Terminal

Mission Zero

M0 · Static on the Line

ROE — Defend only. Simulated data. Investigate, contain, escalate, document. Never exploit or attack.

Step 1 · Severity

Classify severity

Step 2 · First action

Choose first action

After-Action Desk

Shift notes

0
—

Optional. Notes stay in localStorage on this device.

Briefing Terminal · Mission One

Mission One — Phish in the Wire

M1 · Phish in the Wire

ROE — Defend only. Simulated data. Links and attachments are inert — inspect them, never open, detonate, or reply.

Loading mission…

Step 2a · Classify

Classify the message

Step 2b · Justify

Which evidence supports your call?

Evidence locker · Logs (read-only)

Step 2c · Scope

What is the scope?

Step 3 · Contain

Select your containment plan

Step 4 · Document — Incident report

NGL-SOC-8907 · Incident report

Stays in this browser (localStorage). Nothing is uploaded.

After-Action Desk · Mission One

Debrief

0
—

Score breakdown

Gaps & feedback

    Your report

    
        
    
          
          
        
    

        
    
          
    Incoming · Story
    
          
    
          
    
        
    

        
    
          
    Lore crumb
    
          
    
          
    
        
    

        
    
          Start Mission Two
          
          
        
    
        
    Want this drill for your team? Ask CyberLabs — cyberlabs.group.
    
        
      
    
    
    

    

    
    
    
      
    
        
    Briefing Terminal · Mission Two
    
        
    Mission Two — Ghost Process
    
        
    M2 · Ghost Process
    
        
    
          ROE — Defend only.
          Simulated data. Evidence is display-only — never run, download, or test it, and never touch attacker infrastructure.
        
    
        
    Loading mission…
    
        
    
          
          
          
        
    
      
    
    
    

    
    
    
      
    
      
    
      
    
        
        
    
          
    
        
    
        
      
    
    
    

    
    
    
      
    
      
    
      
    
        
    
          
    Step 2a · Classify
    
          
    Classify the incident
    
          
    
          
        
    

        
    
          
    Step 2b · Justify
    
          
    Which evidence supports your call?
    
          
    
          
    
            
          
    
          
        
    

        
    
          
    Evidence locker · Provenance, hunt & audit (read-only)
    
          
    
        
    

        
    
          
    Step 2c · Scope
    
          
    Scope the incident
    
          
    
          
        
    
        
    
          
        
    
      
    
    
    

    
    
    
      
    
      
    
      
    
        
    Step 3 · Contain
    
        
    Select your containment plan
    
        
    
        
    
          
          
        
    
        
        
      
    
    
    

    
    
    
      
    
      
    
      
    
        
    
          
    Step 4 · Document — Incident report
    
          
    NGL-SOC-8936 · Incident report
    
          
    Stays in this browser (localStorage). Nothing is uploaded.
    
          
    
          
          
    
            
            
          
    
        
    
        
      
    
    
    

    
    
    
      
    
      
    
        
    After-Action Desk · Mission Two
    
        
    Debrief
    
        
    
          
    0
    
          
    
            
    —
    
            
    
            
    
          
    
        
    

        
    Score breakdown
    
        
    
          
    
            
          
    
        
    

        
    Gaps & feedback
    
        
      

        
      Your report
      
        
      
        
      
          
          
        
      

        
      
          
      Incoming · Story
      
          
      
          
      
        
      

        
      
          
      Lore crumb
      
          
      
          
      
        
      

        
      
          Start Mission Three
          
          
        
      
        
      Want this drill for your team? Ask CyberLabs — cyberlabs.group.
      
        
      
      
    
      
    

    
    
      
      
      
        
      Briefing Terminal · Mission Three
      
        
      Mission Three — Exfil Whisper
      
        
      M3 · Exfil Whisper
      
        
      
          ROE — Defend only.
          Simulated data. Evidence is display-only — never run, resolve, or test it, and never query or probe attacker infrastructure.
        
      
        
      Loading mission…
      
        
      
          
          
          
        
      
      
      
    
      

    
    
      
      
      
      
      
      
      
        
        
      
          
      
        
      
        
      
      
    
      

    
    
      
      
      
      
      
      
      
        
      
          
      Step 2a · Classify
      
          
      Classify the incident
      
          
      
          
        
      

        
      
          
      Step 2b · Justify
      
          
      Which evidence supports your call?
      
          
      
          
      
            
          
      
          
        
      

        
      
          
      Evidence locker · Asset record, fleet DNS hunt & exfil estimate (read-only)
      
          
      
        
      

        
      
          
      Step 2c · Scope
      
          
      Scope the incident
      
          
      
          
        
      
        
      
          
        
      
      
      
    
      

    
    
      
      
      
      
      
      
      
        
      Step 3 · Contain
      
        
      Select your containment plan
      
        
      
        
      
          
          
        
      
        
        
      
      
    
      

    
    
      
      
      
      
      
      
      
        
      
          
      Step 4 · Document — Incident report
      
          
      NGL-SOC-8961 · Incident report
      
          
      Stays in this browser (localStorage). Nothing is uploaded.
      
          
      
          
          
      
            
            
          
      
        
      
        
      
      
    
      

    
    
      
      
      
      
      
        
      After-Action Desk · Mission Three
      
        
      Debrief
      
        
      
          
      0
      
          
      
            
      —
      
            
      
            
      
          
      
        
      

        
      Score breakdown
      
        
      
          
      
            
          
      
        
      

        
      Gaps & feedback
      
        
        

        
        Your report
        
        
        
        
        
          
          
        
        

        
        
          
        Incoming · Story
        
          
        
          
        
        
        

        
        
          
        Lore crumb
        
          
        
          
        
        
        

        
        
          Start Mission Four
          
          
        
        
        
        Want this drill for your team? Ask CyberLabs — cyberlabs.group.
        
        
      
        
    
        
    

    
    
        
      
        
        
        Briefing Terminal · Mission Four
        
        
        Mission Four — Lantern Court
        
        
        M4 · Lantern Court
        
        
        
          ROE — Defend only.
          Simulated data. Evidence is display-only — never open, forward, render, or fetch it, and never probe attacker infrastructure.
        
        
        
        Loading mission…
        
        
        
          
          
          
        
        
      
        
    
        

    
    
        
      
        
      
        
      
        
        
        
        
          
        
        
        
        
      
        
    
        

    
    
        
      
        
      
        
      
        
        
        
          
        Step 2a · Classify
        
          
        Classify the incident
        
          
        
          
        
        

        
        
          
        Step 2b · Justify
        
          
        Which evidence supports your call?
        
          
        
          
        
            
          
        
          
        
        

        
        
          
        Evidence locker · Mailbox record, fleet signature hunt & exfil estimate (read-only)
        
          
        
        
        

        
        
          
        Step 2c · Scope
        
          
        Scope the incident
        
          
        
          
        
        
        
        
          
        
        
      
        
    
        

    
    
        
      
        
      
        
      
        
        
        Step 3 · Contain
        
        
        Select your containment plan
        
        
        
        
        
          
          
        
        
        
        
      
        
    
        

    
    
        
      
        
      
        
      
        
        
        
          
        Step 4 · Document — Incident report
        
          
        NGL-SOC-8988 · Incident report
        
          
        Stays in this browser (localStorage). Nothing is uploaded.
        
          
        
          
          
        
            
            
          
        
        
        
        
      
        
    
        

    
    
        
      
        
      
        
        
        After-Action Desk · Mission Four
        
        
        Debrief
        
        
        
          
        0
        
          
        
            
        —
        
            
        
            
        
          
        
        
        

        
        Score breakdown
        
        
        
          
        
            
          
        
        
        

        
        Gaps & feedback
        
        
          

        
          Your report
          
        
          
        
          
          
          
        
          

        
          
          
          Incoming · Story
          
          
          
          
          
        
          

        
          
          
          Lore crumb
          
          
          
          
          
        
          

        
          
          
          
        
          
        
          Want this drill for your team? Ask CyberLabs — cyberlabs.group.